Formula injection

Formula injection - also called CSV injection - is an attack on spreadsheets that receive untrusted text. Spreadsheet applications treat any cell beginning with = as a formula, and historically also cells beginning with +, -, or @. An attacker submits a form with a value like =HYPERLINK(...), and the payload does nothing at all until a human opens the sheet - at which point the spreadsheet helpfully executes it.

The consequences range from nuisance to serious. Malicious formulas have been used to exfiltrate data from other cells to an attacker's server, to plant deceptive links, and - in desktop spreadsheet software, via legacy mechanisms like DDE - to attempt command execution on the victim's machine. The attack is insidious because the dangerous moment is far removed from the submission: the form service, the transfer, and the file all look clean along the way.

The standard defense is escaping at write time: any untrusted value beginning with a formula-triggering character gets a neutralizing prefix (conventionally a single quote, which spreadsheets display but do not execute), so the content arrives intact as text and nothing arrives as code. Any system that writes user input into spreadsheets - exports, integrations, form pipelines - needs this guard, because the input is by definition attacker-controlled.

SheetLink Forms writes user input into spreadsheets for a living, so the guard is built into delivery: the worker escapes leading =, +, -, and @ characters in cell values before rows are written to Google Sheets or Excel Online. A submission that tries to smuggle a formula lands as harmless text in the cell, and everything the visitor typed is still legible in the row.

The guard is noted with the rest of the data-handling posture on the security page, and the delivery path it protects is on how it works.